selinux: Add rules for the audit daemon
Change-Id: I050a9ef39d58d2592d880d225d45eb64d8a40b7b
diff --git a/sepolicy/auditd.te b/sepolicy/auditd.te
new file mode 100644
index 0000000..01d5a06
--- /dev/null
+++ b/sepolicy/auditd.te
@@ -0,0 +1,3 @@
+allow logd auditd_log:dir rw_dir_perms;
+allow logd auditd_log:file create_file_perms;
+
diff --git a/sepolicy/file.te b/sepolicy/file.te
index 95a9c38..3a20199 100644
--- a/sepolicy/file.te
+++ b/sepolicy/file.te
@@ -1,2 +1,4 @@
# Support asec containers getting mounted
allow file_type rootfs:filesystem associate;
+
+type auditd_log, file_type;
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index e23df31..9e7f998 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -1,5 +1,9 @@
/cache/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
+# Auditd is a logging daemon. Put it into logd's context
+/system/bin/auditd u:object_r:logd_exec:s0
+/data/misc/audit(/.*)? u:object_r:auditd_log:s0
+
#############################
# performance-related sysfs files (CM)
/sys/kernel/mm/ksm(/.*)? -- u:object_r:sysfs_writable:s0
diff --git a/sepolicy/sepolicy.mk b/sepolicy/sepolicy.mk
index 45792a1..c58ce14 100644
--- a/sepolicy/sepolicy.mk
+++ b/sepolicy/sepolicy.mk
@@ -11,6 +11,7 @@
file_contexts \
genfs_contexts \
seapp_contexts \
+ auditd.te \
installd.te \
netd.te \
system.te \